Cannot assign a policy to Subscription or Resource Group from console

Question

When I try to assign a policy to Subscription or Resource Group from the console, I get the error message: You cannot perform this action without the following permissions over selected scope (Microsoft.Authorization/PolicyAssignments/write)

Answer 1

Hi @Bernard Ervin

Thank you for asking this question on the **Microsoft Q&A Platform. **

Please validate that your user has this permission Microsoft.Authorization/PolicyAssignments/write

If you do not have it ask the global Administrator for that permission.

Hope this helps,
Carlos Solís Salazar

----------

Accept Answer and Upvote, if any of the above helped, this thread can help others in the community looking for remediation for similar issues.
NOTE: To answer you as quickly as possible, please mention me in your reply.

---

Answer 2

@Bernard Ervin Welcome to Microsoft Q&A Platform and thanks for your query. Adding further to @Carlos Solís Salazar , you would need certain permissions to manage Azure Policies.

• Resource Policy Contributor role includes most Azure Policy operations.
• User Access Administrator is necessary to grant the managed identity on deployIfNotExists or modify assignments necessary permissions.

For more information, refer below documents

• https://learn.microsoft.com/en-us/azure/governance/policy/overview
• https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

Answer 3

I have the same problem...trying to assign a policy to a resource group but getting the error about permissions. I have Owner rights for the entire subscription but I still get the error message. I even tried giving myself the explicit Microsoft.Authorization/PolicyAssignments/write permissions on the resource group but I still get the error whenever I try to assign policy. I'm thinking it's a glitch, because I was able to assign a policy yesterday to the very same resource group (I'm evaluating Azure Policy features).

Answer 4

have same error while using sandbox environment